The issue is that there are limitations of the LDAP protocol and PAM, so many options are removed from you. You then have to break the problem to three spaces. * Authentication to workstations (physical access) * Authentication to remote servers (ssh etc) * Authentication to applications (websites etc) So let’s break these down: * To workstations: Certificate authentication can be configured to linux workstations with SSSD with steps found: https://fy.blackhats.net.au/blog/html/2018/02/27/smartcards_and_you_how_t... You can use TOTP/HOTP however there are security risks related to this due to a requirement to distribute the OTP private material to the workstation it self. All workstations should be supplemented with full disk encryption to mitigate this risk. * To servers Use SSH key distribution in LDAP via SSSD. * To websites For this, certificate auth is a webserver + browser issue, and optimally, you would actually use something like oidc/saml via a project like ipsilon or other web based providers. There is a theme here: LDAP is *minimally* used in the authentication process (if at all) and is transformed into a mechanism for the distribution of public authentication components (ssh public keys, public certificates etc). Finally, it is my personal opinion (IE not the opinion of the project or my employer) that kerberos should be avoided as it introduces complexity, fragility and high risk of lateral movement attacks. Kerberos is basically the reason why windows networks are trivially attacked and allows lateral movement. I strongly advise that it should not be used. — Sincerely, William Brown Senior Software Engineer, 389 Directory Server SUSE Labs